Loading story…
Dridex operators distributed updated loader variants through phishing emails carrying malicious Excel attachments, including .xlsm and .xlsb files that impersonated business documents and targeted organizations such as universities in the APAC region. The infection chains used Office macros, Excel 4.0 macros, mshta.exe, regsvr32.exe, and rundll32.exe to fetch and launch DLL payloads from temporary directories, after which the malware profiled infected hosts and sent encrypted system data to hard-coded command-and-control infrastructure over HTTP or HTTPS-like WinINet traffic while disregarding certificate validation problems.
The loader relied on layered anti-analysis and persistence mechanisms that made reverse engineering and detection more difficult. Multiple analyses found Dridex resolving DLLs and Windows APIs through CRC32-based hashing with XOR obfuscation instead of normal imports, decrypting strings and network payloads with RC4, and registering a vectored exception handler via RtlAddVectoredExceptionHandler to convert widespread INT3/RET sequences into indirect API calls. It also supported retrieval of a signed core DLL and encrypted node lists from C2, then maintained execution by copying legitimate System32 binaries alongside malicious DLLs into AppData, abusing DLL hijacking, and creating scheduled tasks for recurring launch.
Pull IOCs and campaign context straight into your stack.
7 events from the most recent confirmed update back to the earliest known activity.
The same APAC-focused Dridex wave peaked on January 21, 2021 before later declining. One analyzed lure document was named "1 Total New Invoices-Thursday January 21 2021.xlsm."
VMware reported a Dridex campaign targeting APAC customers, mostly universities, beginning on January 11, 2021. The infection chain used spam emails with weaponized XLSM attachments posing as invoice notices.
Fortinet analyzed a Dridex campaign using phishing emails with malicious Excel .xlsb attachments such as "HF7.TRANS 2021.08.09.xlsb." The documents used VBA and Excel 4.0 macros to drop an HTA/VBScript stage, download a Dridex DLL, and execute it via rundll32.exe.
Lexfo states the analyzed Dridex loader sample was found in the wild in 2021. The sample used anti-debugging, API hashing, encrypted C2 traffic, and persistence via DLL hijacking and scheduled tasks.
Since mid-2020, a Dridex malicious-document variant began embedding hundreds of encoded payload URLs in Excel worksheets and randomly selecting one at runtime to download the malware. HP's analysis of samples from spam waves between September and December 2020 found six URL encoding methods, showing operators rotated encoding schemes while keeping the loader structure largely consistent.
A Panda Security report states that Dridex version 4, a 64-bit banking Trojan variant, was found in February 2017. The variant used stealth and persistence techniques including AtomBombing, DLL hijacking, scheduled tasks, and explorer.exe/browser injection.
Multiple references state that Dridex first appeared in 2014 and went on to target victims for banking information theft.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 48 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
blog.lexfo.fr
Open source0ffset.net
Open sourcefortinet.com
Open sourceblogs.vmware.com
Open sourcethreatresearch.ext.hp.com
Open sourcepandasecurity.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers detailed two separate malware chains that rely on deeply layered staging, DLL sideloading, and trusted signed software to conceal execution. One campaign, dubbed **Eimeria**, starts from a `RAR5` archive containing the signed `dsclock.exe`, a malicious `zlibwapi.dll`, and an encrypted payload that decrypts into an IExpress package and then an AutoIt-based RunPE loader. The chain restores `ntdll.dll` to evade EDR hooks, decrypts later stages with `AES-128-CBC`, `RC4`, and `LZNT1`, hollows `explorer.exe`, `svchost.exe`, or `taskhostw.exe`, and injects a small .NET RAT that beacons over WebSocket to `94.26.90.139:3006`. It also sets persistence through a Run key and scheduled task and uses delays, sleep checks, and CPU and memory stress tests to frustrate analysis. A second intrusion set tied to **UAC-0184 / MB-0007** used Ukraine-themed lures and messenger delivery to target Ukrainian Defense Forces personnel, beginning with `LNK` files that called `bitsadmin` to fetch `HTA` content from `169.40.135.35` for execution via `mshta`. The downloaded archive abused legitimate Plane9 components for sideloading through `Cluster-Overlay64.exe`, `Plane9Engine.dll`, and `openvr_api.dll`, then decoded `kernel-diag.lib` into `evr.dll` and unpacked `filter.bin` by rebuilding `IDAT` chunks, XOR-decoding with key `0x227E9BDE`, and decompressing with `LZNT1`. The final bundle included signed utilities such as Microsoft-signed `VSLauncher.exe` and a renamed PassMark Endpoint DLL, indicating the actor likely repurposed a signed network stack and dump-capable tooling for covert internal communications, with controller details possibly discovered dynamically over multicast `224.0.0.255:31339` and TCP `31339` rather than a fixed external C2.
Jun 29, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
Researchers reported that **DBatLoader**—also tracked as **ModiLoader** and **NatsoLoader**—has been used in multiple malware delivery campaigns that start with social engineering and end with remote-access trojans such as **Remcos RAT** and **Warzone RAT**. In one observed intrusion, a purchase-order themed malspam message carried an ISO attachment containing a Windows executable disguised with an Excel icon; after execution, the loader retrieved a **4.3 MB** base64 text file from **OneDrive**, decoded additional components on the host, and led to **TLSv1.3** command-and-control traffic with `146.70.158[.]105` over TCP `9138`, consistent with Remcos activity. Another sample abused **Discord** attachment URLs to fetch a second Delphi-based stage and ultimately deploy Warzone RAT, which communicated over TCP `1990`. Technical analyses describe DBatLoader as a **Delphi-based loader** that uses multilayer obfuscation, image steganography, and in-memory decoding before dropping batch scripts, DLLs, and executables into `C:\Users\Public\Libraries`. It establishes persistence through `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`, malicious shortcuts, and copied binaries, while some variants also abuse a **Mock Trusted Directories UAC bypass** and a relative-path DLL hijack involving `easinvoker.exe` and `netutils.dll` to gain elevated execution without a UAC prompt. Researchers said the malware commonly pulls later-stage payloads from public cloud services including **OneDrive**, **Google Drive**, and **Discord**, and has been seen distributing **Formbook**, **Netwire RAT**, **Remcos RAT**, and **Warzone RAT** against business users, including targets in Europe.
Aug 15, 2026